diff --git a/.github/workflows/gcp-marketplace-release.yaml b/.github/workflows/gcp-marketplace-release.yaml
index 7a7c968..c13cc39 100644
--- a/.github/workflows/gcp-marketplace-release.yaml
+++ b/.github/workflows/gcp-marketplace-release.yaml
@@ -22,6 +22,7 @@ env:
 
 jobs:
   publish:
+    environment: publish-marketplace
     runs-on: ubuntu-latest
     steps:
       - name: Validate version format
@@ -46,8 +47,12 @@ jobs:
         env:
           CRANE_VERSION: "v0.22.1"
         run: |
+          set -euo pipefail
           curl -fsSL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" \
-            | tar xz -C /usr/local/bin crane
+            -o /tmp/go-containerregistry_Linux_x86_64.tar.gz
+          echo "0ab7a1d6932a213aed964ce97666c3077fe691c8606413674a8b3e0b9ec4cda0  /tmp/go-containerregistry_Linux_x86_64.tar.gz" \
+            | sha256sum --check
+          tar xzf /tmp/go-containerregistry_Linux_x86_64.tar.gz -C /usr/local/bin crane
 
       - name: Build and push component images
         run: |
@@ -59,7 +64,8 @@ jobs:
             registry=$(yq ".verify.${image}.image.registry" "$values")
             repository=$(yq ".verify.${image}.image.repository" "$values")
             tag=$(yq ".verify.${image}.image.tag" "$values")
-            fullImageName="${registry}/${repository}:${tag}"
+            digest=$(yq ".verify.${image}.image.digest" "$values")
+            fullImageName="${registry}/${repository}:${tag}@${digest}"
 
             printf 'FROM %s' "$fullImageName" | docker buildx build \
               --platform linux/amd64,linux/arm64 \
@@ -75,7 +81,7 @@ jobs:
             --platform linux/amd64 \
             --provenance=false --sbom=false \
             --build-arg TAG="${VERSION}" \
-            --build-arg DEPLOYER_BASE="us-docker.pkg.dev/chainlink-labs-ltd-public/google-marketplace-chainlink-ccv/deployer-base:latest" \
+            --build-arg DEPLOYER_BASE="us-docker.pkg.dev/chainlink-labs-ltd-public/google-marketplace-chainlink-ccv/deployer-base@sha256:87effe04334cc86747bac504c1430f3fff1fc75f5e0d69c8b4ddb73d12e2647b" \
             --load -t "${DEST}/deployer:${VERSION}" .
           docker push "${DEST}/deployer:${VERSION}"
           crane mutate "${DEST}/deployer:${VERSION}" \
diff --git a/.github/workflows/helm-ccv-cell-image-bump.yml b/.github/workflows/helm-ccv-cell-image-bump.yml
index 8bc6292..fccbbed 100644
--- a/.github/workflows/helm-ccv-cell-image-bump.yml
+++ b/.github/workflows/helm-ccv-cell-image-bump.yml
@@ -33,8 +33,8 @@ jobs:
 
       - name: Check Version
         run: |
-          if [[ "$VERSION" != v* ]]; then
-            echo "VERSION must start with 'v', got: '${VERSION}'"
+          if [[ ! "$VERSION" =~ ^v[0-9A-Za-z._-]+$ ]]; then
+            echo "VERSION must match ^v[0-9A-Za-z._-]+$, got: '${VERSION}'"
             exit 1
           fi
 
diff --git a/.github/workflows/helm-ccv-cell-release.yml b/.github/workflows/helm-ccv-cell-release.yml
index b91442e..0135c41 100644
--- a/.github/workflows/helm-ccv-cell-release.yml
+++ b/.github/workflows/helm-ccv-cell-release.yml
@@ -17,9 +17,20 @@ env:
 
 jobs:
   release:
+    environment: publish-chart
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Verify release tag is on main
+        run: |
+          set -euo pipefail
+          if ! git merge-base --is-ancestor HEAD origin/main; then
+            echo "Release tag $GITHUB_REF_NAME does not point to a commit on main"
+            exit 1
+          fi
 
       - name: Set up Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
diff --git a/CODEOWNERS b/CODEOWNERS
index 218aed8..76b7fd4 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1 +1 @@
-* @smartcontractkit/ccip-platform @Angelin01 @khalifaa55
+* @smartcontractkit/ccip-platform
diff --git a/marketplace/gcp/Dockerfile b/marketplace/gcp/Dockerfile
index 0acdbbf..c08d699 100644
--- a/marketplace/gcp/Dockerfile
+++ b/marketplace/gcp/Dockerfile
@@ -1,6 +1,6 @@
 ARG DEPLOYER_BASE=gcr.io/cloud-marketplace-tools/k8s/deployer_helm:latest
 
-FROM alpine:3 AS build
+FROM alpine:3@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 AS build
 
 RUN apk add --no-cache yq tar gettext helm
 
diff --git a/marketplace/gcp/data-test/chart-overlay/values.yaml b/marketplace/gcp/data-test/chart-overlay/values.yaml
index a838eef..154cef3 100644
--- a/marketplace/gcp/data-test/chart-overlay/values.yaml
+++ b/marketplace/gcp/data-test/chart-overlay/values.yaml
@@ -7,11 +7,14 @@ verify:
       registry: docker.io
       repository: library/postgres
       tag: 16-alpine
+      # Source digest for the marketplace re-push; the listing deploys by tag.
+      digest: sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
   curl:
     image:
       registry: docker.io
       repository: curlimages/curl
       tag: 8.21.0
+      digest: sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13
 
 ccv-cell:
   aggregator: